> body JAVASCRIPT_ENCODING_1 /\b(?:\d{1,3}[\s\,]+){8}/
> describe JAVASCRIPT_ENCODING_1 Contains comma seperated
> ascii representations score 0.1 # you can score this by
> itself if you want.
>
> body JAVASCRIPT_ENCODING_2 /document\.write/i
> describe JAVASCRIPT_ENCODING_2 contains document.write
> score 0.1
>
> meta JAVASCRIPT_ENCODING (JAVASCRIPT_ENCODING_1 &&
> JAVASCRIPT_ENCODING_2) describe JAVASCRIPT_ENCODING Uses
> Javascript ascii encoding to hide text score 2.0
>
> i didnt run against my corpus, just use at your own risk :)
>
okay, so i did... i see no reason to use these rules, unless this
becomes a common tactic.
OVERALL SPAM HAM S/O SCORE NAME
10970 6083 4887 0.555 0.00 0.00 (all messages)
2 2 0 1.000 1.00 1.00 JAVASCRIPT_ENCODING_2
18 16 2 0.865 0.60 1.00 JAVASCRIPT_ENCODING_1
0 0 0 0.500 0.00 1.00 JAVASCRIPT_ENCODING
OVERALL% SPAM% HAM% S/O RANK SCORE NAME
10970 6083 4887 0.555 0.00 0.00 (all messages)
100.000 55.4512 44.5488 0.555 0.00 0.00 (all messages as %)
0.018 0.0329 0.0000 1.000 1.00 1.00 JAVASCRIPT_ENCODING_2
0.164 0.2630 0.0409 0.865 0.60 1.00 JAVASCRIPT_ENCODING_1
0.000 0.0000 0.0000 0.500 0.00 1.00 JAVASCRIPT_ENCODING
-------------------------------------------------------
This SF.net email is sponsored by: Perforce Software.
Perforce is the Fast Software Configuration Management System offering
advanced branching capabilities and atomic changes on 50+ platforms.
Free Eval! http://www.perforce.com/perforce/loadprog.html
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
